How to scope e-automate permissions for AI-assisted service work

A common question is whether an AI agent writes to e-automate. It does, as an ECI partner integration that connects via the ESN API. IT leads also need to determine what the agent may write and what data it may access. Auralis writes to e-automate through a service account, and the permissions assigned to that account decide what it can do.

Apply the principle of least privilege. NIST defines it as a security principle that a system should restrict the access privileges of users, or processes acting on behalf of users, to the minimum necessary to accomplish assigned tasks. An AI agent can be treated as a process acting on behalf of users, so least privilege is the right principle to apply. Applying least privilege with e-automate requires deliberate configuration of its security controls.

What e-automate lets you control

Security permissions in e-admin are stored in each company database, and each one may include view, edit, create and delete rights. If a user attempts a transaction without the right it needs, e-automate shows an “insufficient rights” message that names the permission required.

Users inherit the rights of every group they belong to. A deny setting overrides that inheritance, so a user can be blocked from a table even when a group they belong to can reach it. Field-level security goes further. For areas such as Customer (A/R), Accounts (G/L) and Vendor (A/P), each security group can set a field to editable, view-only or hidden, and a user is subject to all the field-level settings of every group they belong to.

On the integration side, ESN authorizes vendors for a specific set of APIs per dealer integration, and it runs as a service on the server.

Steps for a narrow permission set

1. List the approved objects and actions first. Auralis runs under a service account you create, scoped to the objects you approve: contracts, meters, supplies, service calls, invoices and parts. Write down the actions each workflow needs on those objects, then identify the e-automate tables and rights each action requires. Configure the account so that it has no access to objects or actions outside the approved list.

1. Use a separate service account. Don’t share a staff login with the agent. A separate account can be revoked on its own, and Auralis records every read, write and hand-off in its audit log. Ask us to confirm in writing which of these controls apply to your Auralis setup.

1. Copy an existing group or template. ECI recommends copying an existing group or system template with its security already established, so you can see exactly which table permissions and rights it uses. Build the agent’s group from that copy, then remove what it doesn’t need.

1. Grant only the rights each task needs. Avoid the All rights box unless a task requires it, because checking it selects every Allow box for the rows you chose. Where a task only reads data, grant view and nothing more.

1. Deny the tables outside the list. Use deny for areas the agent must never reach, especially where a shared group grants access to them. A deny applies even when the user is a member of a group that has the right.

1. Restrict access to financial fields. Apply field-level security to the areas that hold billing and ledger data, such as Accounts (G/L), Vendor (A/P) and Customer (A/R). Fields the agent only needs to see can be set to view but not edit, and fields it doesn’t need can be hidden.

1. Set the meter-read variance and review exception routing. Auralis posts a meter read on its own only when it falls inside the variance you set. A read outside that variance, a disputed invoice amount, or a request it hasn’t seen before stops and goes to a person with the reason attached. Ask to see the meter-read variance setting and exception routing during the demo.

1. Set audit log retention before go-live. Retention in the Auralis audit log defaults to 30 days and can be set to match your policy. Before go-live, set a retention period that meets your organization’s investigation and audit requirements.

1. Test the service-account revocation procedure. Revoking the service account stops every Auralis read and write. Test that step before go-live, and name the person on your team who can do it. ECI documents stopping the ESN service from the Services module. Confirm the effect on your other integrations with ECI before you treat that as a revoke step.

Review the agent’s rights whenever you add a workflow, and remove any right that no longer has a task behind it. Book a 30-minute walkthrough with your IT lead on access, hosting and the audit log at auralis.ai/demo.

Sources

• ECI, e-automate online help (version 250): Security, Field-level Security, Equipment Solutions Network (ESN) Installation Guide.
• NIST, least privilege, CSRC glossary, citing CNSSI 4009-2022 and NIST SP 800-12 Rev. 1.
• Auralis product information (internal).